Changed users (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user accounts that were changed after the last user snapshot update. Reported changes include name, home folder, group memberships, and user rights. On Windows 2003 domain controllers, only changes in the account User logon name (pre-Windows 2000) are detected. This check does not report users that are excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Changed users

Message String ID and Category	Platform and Message Numeric ID	Message Title and Description	Additional Information
String ID: ESM_USER_NAME_CHANGED Category: Policy Compliance	Windows 2000 (105916) Windows 2003 (205916) Windows 2008 (248916) Windows Vista (228913) Windows XP (200913)	Title: Changed user logon name Description:The user's logon name was changed after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the original logon name.	Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full/display name: %s; logon name: %s; previous logon name: %s]
String ID: ESM_USER_HOMEDIR_CHANGED Category: Policy Compliance	Windows 2000 (105917) Windows 2003 (205917) Windows 2008 (248917) Windows Vista (228914) Windows XP (200914)	Title: Changed user home folder Description:The user's home folder changed after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, reassign the previous folder as the user's home folder.	Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full/display name: %s; new home folder: %s; old home folder: %s]
String ID: ESM_USER_ADDED_TO_GROUP Category: Policy Compliance	Windows 2000 (105918) Windows 2003 (205918) Windows 2008 (248918) Windows Vista (228915) Windows XP (200915)	Title: New user in group Description:The user was added to the group that is reported in the Information field after the last snapshot update. If the addition is authorized, update the snapshot file. If it is not authorized, remove the user from the group.	Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full/display name: %s; added to group: %s]
String ID: ESM_USER_REMOVED_FROM_GROUP Category: Policy Compliance	Windows 2000 (105919) Windows 2003 (205919) Windows 2008 (248919) Windows Vista (228916) Windows XP (200916)	Title: User removed from group Description:The user was removed from the group that is reported in the Information field after the last snapshot update. If the removal is authorized, update the snapshot file. If it is not authorized, restore the user to the group.	Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full/display name: %s; removed from group: %s]
String ID: ESM_USER_RIGHT_ADDED Category: Policy Compliance	Windows 2000 (105920) Windows 2003 (205920) Windows 2008 (248920) Windows Vista (228917) Windows XP (200917)	Title: User right granted Description:The user was granted the user right that is reported in the Information field after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, revoke the right from the user.	Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full/display name: %s; user right: %s]
String ID: ESM_USER_RIGHT_REMOVED Category: Policy Compliance	Windows 2000 (105921) Windows 2003 (205921) Windows 2008 (248921) Windows Vista (228918) Windows XP (200918)	Title: User right revoked Description:The user right that is reported in the Information field was revoked from the user after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the right to the user.	Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full/display name: %s; user right: %s]

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_NAME_CHANGED

Category: Policy Compliance

Windows 2000 (105916)
Windows 2003 (205916)
Windows 2008 (248916)
Windows Vista (228913)
Windows XP (200913)

Title: Changed user logon name

Description:The user's logon name was changed after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the original logon name.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; logon name: %s; previous logon name: %s]

String ID: ESM_USER_HOMEDIR_CHANGED

Category: Policy Compliance

Windows 2000 (105917)
Windows 2003 (205917)
Windows 2008 (248917)
Windows Vista (228914)
Windows XP (200914)

Title: Changed user home folder

Description:The user's home folder changed after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, reassign the previous folder as the user's home folder.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; new home folder: %s; old home folder: %s]

String ID: ESM_USER_ADDED_TO_GROUP

Category: Policy Compliance

Windows 2000 (105918)
Windows 2003 (205918)
Windows 2008 (248918)
Windows Vista (228915)
Windows XP (200915)

Title: New user in group

Description:The user was added to the group that is reported in the Information field after the last snapshot update. If the addition is authorized, update the snapshot file. If it is not authorized, remove the user from the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; added to group: %s]

String ID: ESM_USER_REMOVED_FROM_GROUP

Category: Policy Compliance

Windows 2000 (105919)
Windows 2003 (205919)
Windows 2008 (248919)
Windows Vista (228916)
Windows XP (200916)

Title: User removed from group

Description:The user was removed from the group that is reported in the Information field after the last snapshot update. If the removal is authorized, update the snapshot file. If it is not authorized, restore the user to the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; removed from group: %s]

String ID: ESM_USER_RIGHT_ADDED

Category: Policy Compliance

Windows 2000 (105920)
Windows 2003 (205920)
Windows 2008 (248920)
Windows Vista (228917)
Windows XP (200917)

Title: User right granted

Description:The user was granted the user right that is reported in the Information field after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, revoke the right from the user.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; user right: %s]

String ID: ESM_USER_RIGHT_REMOVED

Category: Policy Compliance

Windows 2000 (105921)
Windows 2003 (205921)
Windows 2008 (248921)
Windows Vista (228918)
Windows XP (200918)

Title: User right revoked

Description:The user right that is reported in the Information field was revoked from the user after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the right to the user.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; user right: %s]